Efficient quantum key distribution over a collective noise channel* 
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We present two efficient quantum key distribution schemes over two different collective-noise 
channels. The accepted hypothesis of collective noise is that photons travel inside a time window 
small compared to the variation of noise. Noiseless subspaces are made up of two Bell states and the 
spatial degree of freedom is introduced to form two nonorthogonal bases. Although these protocols 
resort to entangled states for encoding the key bit, the receiver is only required to perform single- 
particle product measurements and there is no basis mismatch. Moreover, the detection is passive 
as the receiver does not switch his measurements between two conjugate measurement bases to get 
the key. 

PACS numbers: 03.67.Pp, 03.67.Dd, 03.67.Hk 



CO 

> 

O 
O 

00 

o 

oo 
o 



X 



I. INTRODUCTION 



Quantum key distribution (QKD) has become one of 
the most important branches of quantum information. 
The principle of quantum mechanics was introduced into 
communication to ensure its security by Bennett and 
Brassard (BB84) in 1984 Q, which started the vigorous 
development of quantum communication. Different from 
classic communication, the security of quantum commu- 
nication is based on the laws of physics rather than the 
difficulty of computation. The eavesdropper Eve is so 
powerful that her ability is only limited by the principles 
in quantum mechanics. However, the noncloning theo- 
rem forbids Eve to eavesdrop the quantum signals freely 
and fully as her action will inevitably disturb the un- 
known states and leave a trace in the outcomes obtained 
by the two legitimate users. By far, QKD has attracted 
the most attention @, i, H i, @, 0, i, H • 

Photons are popular entities for quantum communica- 
tion since they are fast, cheap, easy to control and inter- 
act weakly with environment. QKD experiments through 
free air and optical fibers have been demonstrated over 
the past 20 years [ill, [3 • ^ is found in the experi- 
mental results that the polarization of photons is incident 
to be influenced by the thermal fluctuation, vibration, 
and the imperfection of the fiber, which are generally 
called noise. Both the inhomogencity of atmosphere in 
a free space and the birefringence in an optical fiber are 
obstacles to the application of quantum communication 
with photon polarization degrees of freedom. The noise 
not only changes the fidelity of quantum states carry- 



*Published in Phys. Rev. A 78, 022321 (2008) 
tEmail address: fedeng@bnu.edu.cn 



ing the information, which will decrease the successful 
probability of schemes consequently, but also gives the 
eavesdropper a chance to disguise her disturbance with 
a better fiber, which will directly impact the key point 
of quantum communication, i.e., its security. The most 
obvious solution is to continuously estimate the transfor- 
mation caused by the noise and compensate for it mo- 
mentarily. This can be denoted as a feedback control 
project. However, this method is difficult in practice and 
it requires an interruption of transmission. If the fluctu- 
ation is too fast, the method is invalid. 

There are two valid methods to solve this problem: 
one is choosing another degree of freedom to encode the 
key bits, and the other is first to theorize the noise and 
then find a way to remove or decrease the noise effect. 
The typical solution of finding a new degree of freedom 
is phase coding, which has been demonstrated in opti- 
cal fibers experimentally pjj]. Although most of the ap- 
paratus in the experiment was polarization-dependent, 
while the polarization of the photon would be influenced 
by the birefringence effect, the Faraday orthoconjuga- 
tion effect [l4j was proposed to circumvent this problem. 
However, the phase-based schemes require complex in- 
terferometers and high precision timing. Moreover, some 
phase coding protocols are two-way communications that 
are susceptive to Trojan horse attack [a. fl5|. The second 
method is first constructing an appropriate noise model, 
and then finding a resolvent accordingly, such as quan- 
tum error correct code (QECC)[l6|, single-photon error 
rejecti on [l7l.[l8| . quantum error-rejection code with two 
qubits llg. |20| . Y2A\ . and decoherence-free subspace (DFS) 
[22l |23l |24|] . The QECC encodes one logical bit into sev- 
eral physical qubits according to the type of noise, and 
then the users measure the stabilizer codes to detect er- 
rors and correct them. For single-photon error rejection 
schemes and protocols utilizing the idea of DFS, there is 
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an important precondition called as the collective noise 
assumption [25j. That is, the photons travel inside a 
time window that is shorter than the variation of noise. 
In other words, if several qubits transmit through the 
noise channel simultaneously or they are close to each 
other spatially, the transformation of the noise on each 
of the qubits is identical. 

The single-photon error rejection schemes transmit 
photons faithfully without ancillary qubits through a col- 
lective noise channel. The two parts of the photon split 
by a polarizing beam splitter (PBS) are adjusted to have 
a time delay, and then they suffer from the same noise 
consecutively. The effect of noise is cancelled by select- 
ing the final state arriving at a special time slot. In other 
words, the state collapses into a subspace that is not im- 
pacted by the noise with a certain probability. Kalamidas 
proposed a single-photon error rejection protocol in 2005 
17], which is efficient and convenient except for the use 
of Pockels cells (PC). Recently, we presented a single- 
photon transmission scheme with linear optics against 
collective noise [18j |. in which only passive linear optical 
elements are required. In a sense, the schemes using only 
single-photon states to reject errors can be regarded as a 
kind of DFS scheme in which the time degree of freedom 
is introduced to form the DFS with the two polarization 
parts. 

The DFS can be made up of several qubits which expe- 
rience the same noise and compensate the effect of noise 
to implement a fault-tolerance communication. Walton 
et al pro posed a QKD scheme using the idea of DFS in 
2003 [22|]. In their scheme, the logical qubit is encoded 
into two time-bin qubits to protect the quantum system 
against a collective-dephasing noise. The Hilbert space 
is extended by the time degree of freedom, so that the re- 
ceiver could perform his measurement with a fixed basis. 
Later, Boileau et al. presented a QKD protocol with a 
collective random unitary error model by using the linear 
combinations of two singlet states which are invari- 

ant under whatever rotations [HI]. The spatial degree of 
freedom is also introduced to distinguish the states. How- 
ever, the receiver has to discard half of the samples due 
to the inconclusive results, similar to traditional QKD 
protocols such as BB84 QKD protocol in which the two 
legitimate users abandon half of the outcomes owing to 
wrong measurement bases. Recently, Wang proposed a 
robust QKD using a subspace of two-qubit states [24[. 
The states being transformed out of the subspace by the 
collective rotation are rejected by a parity check and then 
the total error rate in the QKD protocol decreases. 

In this paper, we present two fault-tolerant quantum 
key distribution schemes against collective noises. One is 
used against a collective-dephasing noise and the other 
is used against a collective-rotation noise. The DFS is 
spanned by two entangled states, and the spatial and 
polarization degrees of freedom are both introduced. The 
receiver uses passive detection, i.e., he is not required to 
switch between conjugate measurements, to obtain the 
related outcomes. The most important merit of these two 



schemes is that there is no basis mismatch, which means 
there is no abandonment of samples owing to wrong basis 
measurement in these two schemes. 



II. QUANTUM KEY DISTRIBUTION AGAINST 
A COLLECTIVE NOISE 

We select special Bell states according to the form of 
noise to build blocks for constructing a decoherence-free 
subspace. The key bits are encoded on the states and the 
relative order of the photon pairs. 



A. QKD against a collective-dephasing noise 

A collective-dephasing noise can be described as 

t/|0) = |0), tf|l>=e*|l>, (1) 

where <j> is the parameter of the noise and it fluctuates 
with time. Generally, the logical qubit encoded into two 
physical qubit product states in the following is immune 
to this collective-dephasing noise as the two logical qubits 
acquire the same phase factor e^, 

|0) L = |01), |l) i = |10), (2) 

where the subscript L represents the logical bit, and |0) 
and |1) represent the horizontal polarization state and 
the vertical one, respectively, which are the two eigen- 
states of Pauli operator a z (Z basis). We choose two 
superpositions of these two logical bits to form a DFS. 
They are two antiparallel Bell states written as 

NT) - -^(|oi)-|io», (3) 

|V. + ) = -^(|01) + |10)). (4) 

Generally speaking, a secure QKD protocol needs at 
least two nonorthogonal measuring bases. The eaves- 
dropper cannot obtain the information directly and will 
disturb the quantum state without the knowledge of its 
basis information. However, the use of two nonorthog- 
onal bases results in the abandonment of half instances 
measured by the receiver with wrong bases, or calls for 
the technique of quantum storage, which is difficult at 
present. For constructing an efficient QKD protocol, 
we pack two two-particle entangled states as one group 
and introduce the spatial degree of freedom to form the 
nonorthogonality. The spatial degree of freedom means 
the relative orders of the four particles. Two permuta- 
tions are used to form the two spatial bases to prepare 
the quantum states, shown in Fig 1. There are the neigh- 
boring basis |W) in which the two entangled particles are 
in proximity and the crossing basis | $) in which particles 
of the two entangled states are ranged alternately. 
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FIG. 1: Schematics of the two spatial bases. Lines represent 
the entanglement between particles. 



The four states with which we encode the logical bits 
can be written as 



yap 



|^ + >12® |^ + ) 3 4, 
\i>~)l2 <8> |V J_ >34, 
|V^ + )l3® |^ + >24, 
|^~)l3 ® |^~>24- 



(5) 
(6) 
(7) 
(8) 



Here the subscripts and 1 on the left side represent the 
key bits encoded, and subscripts {1,2,3,4} on the right 
side denote the sequence of these four particles on the line 
of transmission. We can distinguish them by their time 
of arrival. Under the assumption of collective noise, the 
interval between the first and the fourth photons should 
be shorter than the fluctuation time of the noise param- 
eter (/>, which ensures that these four photons suffer from 
the same noise. 

These four states in terms of the X basis | ± x) are 
shown below, where | ± x) = ^=(|0) ± are the two 
eigenstate of the Pauli operator a x . For the sake of sim- 
plicity, we use |±) representing | ± x) in the following: 



% p = a + b, 
tf ? p = c - d. 
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verify that 



For 



It is not difficult iu vcniy waii \n \-±f x 

0,<<^|$f> = and ($*|**) = i (< = 0,1). 
each basis and <J> rfp , the receiver can distinguish the 
two states in a deterministic way with four single-particle 
measurements . 

Now, let us describe the QKD scheme in detail as fol- 
lows: 



(51) The sender Alice chooses a random (n + 25) bit 
string K and a random (n + 25) bit string B. 

(52) Alice encodes each bit of the key string K ac- 
cording to {|\f'o P ), I*?)} if the corresponding bit in the 
basis string B is 0, or encodes into {|$o P ); 1^?)} if the 
corresponding bit in B is 1. 

(53) Alice sends the (n + 25) four-particle states to the 
receiver Bob. 

(54) Bob performs the single-particle product measure- 
ments on each quartet after the receipt subsequently. He 
selects randomly 25 states from the sequence for eaves- 
dropping check, where 5 states are measured with the Z 
basis and the other 5 samples are measured in X basis. 
The residual n samples used to share the secret key are 
measured in X basis. Bob records all of the measurement 
results. 

(55) Bob tells Alice the positions of groups chosen for 
eavesdropping check and asks Alice for the initial states 
of these samples. After receipt of these message, Bob 
checks the security of the transmission by estimating the 
error rate. If the error rate is acceptable, they continue 
to the next step. Otherwise, they abort the protocol. 

(56) After they affirm the security of the transmission, 
Alice announces B, with which Bob can determine the 
key bits. These results are taken as a raw key string. 
Error correction and privacy amplification are required 
to obtain the final key. 

Except for the samples used for the security analysis 
with the Z basis measurements, all the other photons are 
measured with the X basis. That means the receiver is 
not required to switch between conjugate measurement 
bases to get the message. And this scheme is efficient 
as with Alice's information of the basis, all the instances 
are used to generate the key, not just 1/4 of those in the 
QKD scheme against a collective-dephasing noise shown 
in Ref. Moreover, it does not require the receiver 

Bob to measure his photons with joint two-photon mea- 
surements, different from that in Ref. [221 ] - 



B. QKD against a collective-rotation noise 

Another common noise model called collective unitary 
rotation noise satisfies 



U r \Q) = cos6\0) +sin9\l) 
U r \l) = -sin6\0)+cos0\l). 



(17) 



The parameter 9 depends on the noise in the quantum 
channel and fluctuates with time. With such a type of 
collective errors, we choose and |^ + ) to form the 

DFS, where 



-> = i=(|00) + |ll». 



(18) 



They are invariant under this type of rotation. Similar 
to the method used above, we pack two entangled states 
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as one group. Four combinations to code the key bits are 



where 





= |0 + )l2® 


l0 + ) 3 4 = e + /, 


(19) 




= IVOia® 


IV ;_ >34 =g-h, 


(20) 




= |0 + )l3® 


l0 + )24 = e + .g, 


(21) 




= |V'")l3® 


IVO24 = f-h, 


(22) 
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= ^(loooo) 


+ |1111»1234, 


(23) 
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= ^(10011) 


+ |1100))i 2 34, 


(24) 


9 


= |(|0101> 


+ |1010))i 2 34, 


(25) 


h 


= 5(10110) 


+ |1001))i 234 . 


(26) 


to 


find that the superposition 


terms of 



{$q, <&J, Wq, ^i} on the Z basis is similar to those of 
^ ^ ydpy on the x basig In this QKD prQt0 _ 

col, the sender Alice prepares a sequence of quartet states 
randomly in *o(^o) or *i(*i) to denote the key bit 
or 1. The choice of the basis for each state is stochas- 
tic. Then she sends the sequence to Bob. Bob chooses a 
sufficiently large subset of the multiplets as the checking 
samples and measures them with the measuring bases X 
and Z randomly. The other groups of states are measured 
with Z basis. Bob records all of the measurement results 
and tells Alice the positions of checking samples he se- 
lected. With Alice's information of the original states 
of these checking samples, Bob analyzes the error rate. 
If the error rate is reasonably low, they determine the 
channel is secure. Otherwise, they abandon their mea- 
surement results and repeat the communication from the 
beginning. After ensuring the security of transmission, 
Alice tells Bob the spatial bases she used to produce the 
quartets, with which Bob can deduce the key sequence 
from his measurement outcomes. 



III. SECURITY ANALYSIS 

For one-way quantum communication, there are two 
main means of eavesdropping, one is the intercept and 
resend attack fi"5| and the other is that using an auxiliary 
particle to interact with the particles carrying messages 
and measuring the auxiliary photon to get some useful 
information. The interaction can be two-particle unitary 
operation or controlled-not (CNOT) gate 16]. For sim- 
plicity, we denote the eavesdropping check by measuring 
samples with the X(Z) basis as the X(Z) check in the 
following. 

Considering the first QKD scheme against a dephasing 
noise, as key bits are encoded into four-particle entangled 
states, the direct eavesdropping done by the eavesdrop- 
per Eve is the intercept-measure-resend attack. There 
are two kinds of measurements: the single-particle prod- 
uct measurements and the Bell-basis measurements. For 



this scheme, the receiver Bob can obtain the message 
only in the X basis. If her measurement outcome is a 
decomposition of a (d), Eve concludes that the key bit 
is (1) directly. For other results, Eve cannot get the 
key until Alice publishes the information of spatial bases, 
\pdp or (jjdp jf resenc [g a fgijg state(one of the four 

states, a, 6, c, d) to Bob according to her measurement 
results, the error rate in X check is ex = and the 
error rate in Z check is ez =50%. So the average er- 
ror rate is &a =25%. There is another way to resend 
the fake state. The eavesdropper Eve guesses the origi- 
nal states according to her results and resends entangled 
fake states. From Eqs. ©-([S]), one can see that Eve will 
get a wrong state with half opportunity, which will be 
discovered with probability 25% both in X check and Z 
check. The average error rate of resending a guess state 
is 25%. The calculation of the error rate when Eve is 
measuring in the Bell basis is a little complex because of 
the quantum entanglement swapping phenomenon [26| . 
There is a half opportunity for Eve to choose the correct 
spatial basis. For a wrong basis, Eve can detect her mis- 
take with 50% due to the appearance of as results 
of entanglement swapping and then change the basis to 
prepare a fake state. This method will cause a 25% error 
rate in X check and 12.5% in Z check, while the aver- 
age error rate is 19.25%. It is important to point out 
that with Bell-state measurements, Eve cannot get the 
key message until the bases are published by Alice. The 
error rates of some eavesdropping are shown in Table I. 

From Eqs. (f5"l)- (fH>]) . we find the parity of two parti- 
cles in the X basis can reveal the key bit. For example, 
photons 3 and 4 are parallel in \^ P ) and antiparallel in 
|\&i P ). Photons 2 and 4 are parallel in \Qq P ) and antipar- 
allel in \$>f p ). The eavesdropper can utilize an auxiliary 
photon prepared in to get the key message by means 
of two CNOT operators C35 and C45 along the x direc- 
tion, where Cij means using particle i as control bit and 
j as target bit. After the two CNOT gates, Eve measures 
photon 5 in the X basis. The outcome |+)(|— )) means 
the two photons 3 and 4 are parallel (antiparallel) and 
the key bit is (1). If Eve guesses the right spatial bases 
\^ dp ) or |<E> dp ), her action will not be detected and she 
can get the key bit with the basis information. Other- 
wise, this method will introduce a 50% error rate in Z 
check. 



TABLE I: The relation between the error rate and the eaves- 
dropping attack on the QKD protocol against the dephasing 
noise. 



dephasing noise 


ex 


ez 


eA 


MB: X, resend: product state 





50% 


25% 


MB: X, resend: entangled state 


25% 


25% 


25% 


MB: Bell, resend: entangled state 


25% 


12.5% 


19.25% 


CNOT on auxiliary on X basis 





25% 


12.5% 



For the second QKD scheme, the calculation of error 
rates for different attacks is similar to the first one. A lit- 
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TABLE II: The relation between the error rate and the eaves- 
dropping attack on the QKD protocol against the rotation of 
polarization . 



polarization rotation 


ex 


ez 


eA 


MB: X, resend: product state 





50% 


25% 


MB: X, resend: entangled state 


25% 


25% 


25% 


MB: Z, resend: product state 


50% 





25% 


MB: Z, resend: entangled state 


25% 


25% 


25% 


MB: Bell, resend: entangled state 


25% 


25% 


25% 


CNOT on auxiliary on Z basis 


25% 





12.5% 



tic difference is caused by the fact that the states used in 
the second protocol are symmetry in the two measuring 
bases (MBs) X and Z. The error rates are listed in Table 
II. From these two tables, we find that the eavesdropper 
will introduce at least 12.5% error inevitably when she 
tries to wiretap. She will be detected by the two legit- 
imate users. Eve can get half of the key bits both by 
X measurement and Z measurement with disturbing the 
unknown quantum states, but Alice will announce the 
preparation bases after the security check and the key bit 
will be used to encrypt secret message after they confirm 
its security. So this QKD protocol is secure in principle. 



IV. DISCUSSION AND SUMMARY 

Compared with the QKD scheme in Ref. 22], our first 
QKD scheme over a collective-dephasing noise channel 
has the advantage of having a higher intrinsic efficiency 
[30| as that in the former is 1/4 and almost all the in- 
stances in our scheme can be used to distill the private 
key. Moreover, this scheme requires the receiver Bob only 
to perform single-photon measurements for obtaining the 
outcomes used for distilling the private key and does not 
require him to switch the choice of the measuring bases, 
which will make the measurement simpler than that in 
Ref. [22J. On the other hand, in order to encode the 
states p and $ p , the sender Alice needs to possess 
some modulators for spatial modes, which will increase 
the difficulty of the preparation of the logical qubit states. 
At present, Alice can exploit the similar apparatus com- 
posed of optical delays and switches in Ref. Q to adjust 
the states ty dp and Also, Alice should prepare two 
EPR pairs for each logical states. Although this task can 
be accomplished at present by sending a pump pulse of 
ultraviolet light back and forth across a beta barium bo- 
rate crystal [27l [28| , it is not in a practical application 
extensively. 

Our second QKD scheme against a collective-rotation 
noise has a higher intrinsic efficiency than that in the ro- 
bust polarization-based QKD scheme 23[ as almost all 
the instances in our scheme can be used to create the pri- 
vate key and about 1/4 of the instances in the latter are 
useful (it can be improved to be 1/2 if the proportion of 
the samples exploited by the two parties to analyze the 



security of the quantum channel to all the instances ob- 
tained is small). As the symmetry of the encoding states 
shown in Eqs. (fH?|) - (f2"2"l) we get a scheme quite similar to 
a BB84 QKD protocol [l| with four-dimensional quantum 
systems. However, the scheme introduced in Ref. [23[ is 
more similar to the B92 QKD protocol 0]. Through a 
channel with loss, our QKD scheme may be more secure 
than that in Ref. 

The idea of using only a few X bases to check the eaves- 
dropping was proposed ten years ago (29| . Its main aim is 
to reduce the fraction of discarded data caused by wrong 
basis measurement. There are some differences between 
it and our schemes. First, in Ref. 29] a predominant 
basis is used to prepare and measure the states, but in 
ours a predominant basis is only used to distill the key 
bits. That is, states transmitting in the quantum channel 
are completely random in the four states in our schemes, 
so that a refined analysis of error rate was required to 
prevent the eavesdropper from getting information using 
the predominant basis in the former, while the error rate 
analysis of ours is similar to the BB84 QKD protocol, 
as is the security. Second, the samples for eavesdrop- 
ping check are chosen by Bob, which makes the process 
efficient as each one selected is useful. 

In summary, we propose two QKD schemes to share 
a sequence of key with two different kinds of collective- 
noise channels. The interference and two-way quantum 
communication is not required to solve the problem of 
collective noises. Despite a little difference in measuring 
basis and the states used to encode the logical bits, the 
essence of these two schemes is quite similar. That is, the 
legitimate user utilizes the special Bell states which are 
invariant under the given noise model to protect the sys- 
tem against the noise and introduces the spatial degree of 
freedom to form two nonorthogonal bases with which the 
key rate is increased compared to protocols abandoning 
half instances due to wrong measuring bases. There are 
several remarkable advantages in our two schemes. First, 
the samples for security check are not asked to be mea- 
sured with an entangled basis. The samples are chosen 
randomly by the receiver Bob which is easier, compared 
with the QKD schemes with a decoy state, in which the 
sender Alice inserts her decoy state into the massage se- 
quence and tells Bob the positions after the transmission. 
Second, it is unnecessary for the two parties to discard 
samples. Except for eavesdropping check, almost all of 
the states transmitted are used to share the private key. 
Moreover, although the logical bits are encoded into en- 
tangled states, the receiver only needs to perform single- 
particle product measurements on his photons, not joint 
two-particle Bell-state measurements. Except for the re- 
quirement of two nonorthogonal bases measurement for 
eavesdropping check, Bob need not switch his two con- 
jugate bases to obtain the key. Only passive detection is 
enough to get the message. 

Schemes using several physical bits to present one logi- 
cal bit are fragile with photon loss and hence the commu- 
nication distance is restricted. This is a tradeoff between 
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the transmission distance and the degree of fault toler- 
ance. More research and development of technique are 
expected to solve this problem in the future. 

Note added As the parity of the state of two EPR 
pairs transmitted as a group can be detected with 
controlled-not operations and an auxiliary particle, with- 
out disturbing the quantum system, the two parties Alice 
and Bob can only exploit each two EPR pairs to carry one 
bit of information securly over a collective-noise chan- 
nel. In the same way, the two parties in Ref. 0] should 
at least distill one bit of information about the parity 
of each group of EPR pairs with privacy amplification; 
otherwise, the eavesdropper Eve can obtain one bit of 
information for each group of EPR pairs freely. With in- 
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